Prioritizing and resolving inconsistencies in digital evidence

ABSTRACT

A system for prioritizing and resolving inconsistencies in digital evidence. The system includes a database containing a first type of data and a second type of data related to an incident record and an electronic computing device including an electronic processor. The electronic processor is configured to receive the first and second types of data from the database, determine an inconsistency between the first and second types of data, and determine an incident type from the incident record. The electronic processor is also configured to determine whether a priority of the determined inconsistency meets a threshold case impact level. When the priority of the inconsistency meets the threshold case impact level, the electronic processor is configured to take a first notification action and when the priority of the inconsistency does not meet the threshold case impact level, the electronic processor is configured to take a second notification action.

BACKGROUND OF THE INVENTION

When an incident (for example, a crime, automobile accident, fire, orthe like) occurs, numerous pieces of evidence are gathered. Often, thisevidence is used to create an incident record in, for example, a recordsmanagement system (RMS). The actual pieces of evidence and the incidentrecords are used by law enforcement, legal counsel, and other users toanalyze and prosecute a case associated with the incident. Steps in alife cycle of a case, each step defined by which users have control ofevidence is sometimes referred to as a chain of evidence. Various typesof evidence may be gathered from a variety of sources (for example,video evidence from body-worn cameras, video from CCTV cameras, writtensummaries prepared by first responders, smart telephone video frompassersby, witness accounts, physical evidence, and other evidence).Sometimes there are inconsistencies in the evidence included in theincident record.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The accompanying figures, where like reference numerals refer toidentical or functionally similar elements throughout the separateviews, together with the detailed description below, are incorporated inand form part of the specification, and serve to further illustrateembodiments of concepts that include the claimed invention, and explainvarious principles and advantages of those embodiments.

FIG. 1 is a block diagram of a system for prioritizing and resolvinginconsistencies in digital evidence in accordance with some embodiments.

FIG. 2 is an illustrative example of a chain of evidence.

FIG. 3 is a block diagram of a user device of the system of FIG. 1 inaccordance with some embodiments.

FIG. 4 is a block diagram of a database of the system of FIG. 1 inaccordance with some embodiments.

FIG. 5 is a block diagram of an electronic computing device of thesystem of FIG. 1 in accordance with some embodiments.

FIG. 6 is a flowchart of a method of prioritizing and resolvinginconsistencies in digital evidence in accordance with some embodiments.

FIG. 7 is a flow chart of a method of resolving inconsistencies indigital evidence in accordance with some embodiments.

Skilled artisans will appreciate that elements in the figures areillustrated for simplicity and clarity and have not necessarily beendrawn to scale. For example, the dimensions of some of the elements inthe figures may be exaggerated relative to other elements to help toimprove understanding of embodiments of the present invention.

The apparatus and method components have been represented whereappropriate by conventional symbols in the drawings, showing only thosespecific details that are pertinent to understanding the embodiments ofthe present invention so as not to obscure the disclosure with detailsthat will be readily apparent to those of ordinary skill in the arthaving the benefit of the description herein.

DETAILED DESCRIPTION OF THE INVENTION

As described above, incident records often include different types ofdata (evidence) and inconsistencies sometimes exist between these typesof data. Studies have shown that inconsistencies in incident recordscause users (for example, law enforcement officers) to spend a largeamount of time reviewing, for example, video and comparing video recordsto their reports to discover inconsistencies. Eliminatinginconsistencies is important to ensure that cases are not dismissed ordelayed and that downstream users in a chain of evidence are allowedtimely access to data without having to redo work due toinconsistencies. Thus, it would be useful to automatically discover andnotify users of inconsistencies in evidence to improve the accuracy andfunctioning of record management systems and databases. Among otherthings, reducing inconsistencies may reduce the amount of time usersspend reviewing evidence and redoing work, which in turn may reduce theprocessing power and memory resources consumed by the record managementsystem. Additionally, reducing inconsistencies increases the speed ofproviding accurate information.

Inconsistencies may arise due to differences between witness accounts.For example, an inconsistency occurs when a distraught victimunintentionally provides an incorrect description of a suspect thatdiffers from the description provided by other witnesses. In anotherexample, an inconsistency occurs when an officer's incident reportindicates that contraband was discovered in the back seat of a car, butvideo footage shows that the contraband was retrieved from the frontseat of the car. In yet another example, an inconsistency occurs when anofficer's incident report indicates that a suspect was wearing a redshirt, video footage from a body-worn camera footage indicates that thesuspect was wearing a blue shirt.

The evidence, or more broadly, information or data collected is part ofa digital chain of evidence (which may include various databases anddata stores). As noted, inconsistencies in the evidence may be difficultto detect and resolve. Additionally, inconsistencies have differentpriorities based on the potential impact an inconsistency has on a case(for example, a legal case prosecuting an alleged criminal), the type ofincident the inconsistency is associated with (for example, homicide asopposed to petty theft), and the like. For example, an inconsistencyregarding the color of a shirt a suspect was wearing while committing acrime is a minor inconsistency but an inconsistency regarding who begana physical assault is an important inconsistency. When an inconsistencyin the evidence in an incident record is detected, it is important thatappropriate actions are taken to ensure that the inconsistency isresolved to improve accuracy, improve the speed of retrieving accurateinformation, and reduce potential negative consequences to a case. Forexample, if the inconsistency does not have a high priority it may bedesirable to allow a detective access to the incident record but if theinconsistency has a high priority it may be desirable to block adetective from accessing the incident record until the inconsistency isresolved. To ensure that an inconsistency is resolved, it is importantto notify the appropriate users of the inconsistency, for example, userswho created or uploaded the inconsistent data (the originators of theinconsistent data), users who are identified in the inconsistent data,or users who accessed the inconsistent data. Therefore, a system whichnot only detects inconsistencies in data included in an incident recordbut also determines actions to take based on the determined importance(i.e., priority) of the detected inconsistency and the appropriate usersto inform to resolve the detected inconsistency would be beneficial.

Embodiments described herein provide, among other things, a method andsystem for prioritizing and resolving inconsistencies in digitalevidence.

One example embodiment provides a system for prioritizing and resolvinginconsistencies in digital evidence. The system includes a databasecontaining a first type of data including electronically storedmultimedia data related to an incident record and a second type of dataincluding electronically stored first responder notes or reports relatedto the incident record. The system also includes an electronic computingdevice including an electronic processor. The electronic processor isconfigured to receive the first type of data and the second type of datafrom the database, determine an inconsistency between the first type ofdata and the second type of data, and determine an incident type fromthe incident record. The electronic processor is also configured todetermine, by accessing one or both of an incident type mapping and amachine learning model using the determined incident type, whether apriority of the determined inconsistency meets an electronically storedthreshold case impact level. When the priority of the inconsistencymeets the stored threshold case impact level, the electronic processoris configured to take a first notification action and when the priorityof the inconsistency does not meet the stored threshold case impactlevel, the electronic processor is configured to take a secondnotification action different from the first.

Another example embodiment provides a method of prioritizing andresolving inconsistencies in digital evidence. The method includesreceiving, with an electronic processor, a first type of data includingelectronically stored multimedia data related to an incident record anda second type of data including electronically stored first respondernotes or reports related to the incident record from a database. Themethod also includes determining an inconsistency between the first typeof data and the second type of data, determining an incident type fromthe incident record, and determining, by accessing one or both of anincident type mapping and a machine learning model using the determinedincident type, whether a priority of the determined inconsistency meetsan electronically stored threshold case impact level. The method furtherincludes when the priority of the inconsistency meets the storedthreshold case impact level, taking a first notification action and whenthe priority of the inconsistency does not meet the stored thresholdcase impact level, taking a second notification action different fromthe first.

FIG. 1 is a block diagram of a system 100 for prioritizing and resolvinginconsistencies in digital evidence. In the example shown, the system100 includes a database 105, an electronic computing device 110, a firstdata source 115 and a second data source 120 (referred to hereincollectively as the data sources 115,120), and a first user device 125and a second user device 130 (referred to herein collectively as theuser devices 125,130). The database 105, electronic computing device110, data sources 115, 120, and user devices 125, 130 arecommunicatively coupled via a communication network 135. Thecommunication network 135 is an electronic communications networkincluding wireless and/or wired connections. The communication network135 may be implemented using a variety of one or more networksincluding, but not limited to, a wide area network, for example, theInternet; a local area network, for example, a Wi-Fi network, or anear-field network, for example, a Bluetooth™ network. Other types ofnetworks, for example, a Long Term Evolution (LTE) network, a GlobalSystem for Mobile Communications (or Groupe Special Mobile (GSM))network, a Code Division Multiple Access (CDMA) network, anEvolution-Data Optimized (EV-DO) network, an Enhanced Data Rates for GSMEvolution (EDGE) network, a 3G network, a 4G network, a 5G network, andcombinations or derivatives thereof may also be used.

It should be understood that the system 100 may include differentnumbers of user devices and that the two user devices 125, 130 includedin FIG. 1 are purely for illustrative purposes. It should also beunderstood that the system 100 may include different numbers of datasources and that the two data sources 115, 120 included in FIG. 1 arepurely for illustrative purposes. It should also be understood that thesystem 100 may include a different number of electronic computingdevices than the number of electronic computing devices illustrated inFIG. 1 and the functionality described herein as being performed by theelectronic computing device 110 may be performed by a plurality ofelectronic computing devices.

In the embodiment illustrated in FIG. 1, the electronic computing device110 is, for example, a server that is configured to prioritize andresolve inconsistencies in digital evidence. In the embodimentillustrated in FIG. 1, the user devices 125, 130 are electronic devices(for example, a smart telephone, a laptop computer, a desktop computer,a smart wearable, or other type of portable electronic device configuredto operate as described herein). Each of the user devices are configuredto send and receive information from the database 105. Likewise, each ofthe data sources 115, 120 are configured to send information to thedatabase 105. A data source may be for example, a camera, a microphone,or other type of sensor configured to collect data regarding anincident. A data source of the plurality of data sources 115, 120 may bemounted or stationary, for example, a data source may be a body-worncamera worn by a police officer, a camera installed in a vehicle, or acamera mounted on a wall of a building. It should be noted that each ofthe user devices 125, 130 may be any one of the above mentioned optionsregardless of which of the above mentioned options are used for theother user devices in the system 100. For example, in one embodiment thefirst user device 125 may be a smart telephone while the second userdevice 130 may be a smart wearable. It should also be noted that each ofthe data sources 115, 120 may be any one of the above mentioned optionsregardless of which of the above mentioned options are used for theother data sources are in the system 100. For example, the first datasource 115 may be a camera while the second data source 120 may be aninfrared sensor. Additionally, in some embodiments, the functionalitydescribed herein as being performed by a data source is insteadperformed by a user device. In some embodiments, the system 100 does notinclude data sources and instead relies on user devices to perform thefunctionality of data sources.

FIG. 2 is an illustrative example of a chain of evidence 150. Asillustrated in FIG. 2, the chain of evidence 150 includes a plurality ofsteps that begin when data (evidence) is added to a records managementsystem and ends when a decision is made as to how long the data will bestored in the records management system. Different users access the dataat different steps in the chain of evidence 150. For example, policeofficers access the data at the entry step 155 and review step 160 butdetectives access the data at the analysis step 165. Inconsistencies mayoccur at a number of steps in the chain of evidence 150. In one example,an inconsistency may occur at the entry step 155 when a police officerenters a report that contradicts received video evidence. In anotherexample, an inconsistency may occur when a detective submits a reportafter reviewing the evidence at the analysis step 165. An inconsistencyat one step may be the cause of an inconsistency at another step in thechain of evidence 150. For example, there may be an inconsistencybetween a police officer's report and video evidence. If, at a laterstep in the chain if evidence 150, a detective relies on the policeofficer's report to create an investigation report, the investigationreport may include the same inconsistency as the police officer'sreport.

FIG. 3 is a block diagram of the first user device 125 included in thesystem 100. In the example illustrated, the first user device 125includes a first electronic processor 200 (for example, amicroprocessor, application-specific integrated circuit (ASIC), oranother suitable electronic device), a first memory 205 (anon-transitory, computer-readable storage medium), a first communicationinterface 210 (including, for example, a transceiver for communicatingover one or more networks (for example, the network 135)), a displaydevice 215, and an input device 220. The first memory 205 may include,for example, a hard disk, a CD-ROM, an optical storage device, amagnetic storage device, a read only memory (ROM), a programmable readonly memory (PROM), an erasable programmable read only memory (EPROM),an electrically erasable programmable read only memory (EEPROM), a Flashmemory, or a combination of the foregoing. The first electronicprocessor 200, first communication interface 210, first memory 205,display device 215, and input device 220 communicate wirelessly or overone or more communication lines or buses.

The display device 215 may be, for example, a touchscreen, a liquidcrystal display (“LCD”), a light-emitting diode (“LED”) display, anorganic LED (“OLED”) display, an electroluminescent display (“ELD”), andthe like. The input device 220 may be, for example, a touchscreen (forexample, as part of the display device 215), a mouse, a trackpad, amicrophone, a camera, or the like. It should be understood that thefirst user device 125 may include more, fewer, or different componentsthan those components illustrated in FIG. 3. For example, the first userdevice 125, while illustrated as having only one input device, mayinclude multiple input devices and may include an output device such asspeakers. Also, it should be understood that, although not described orillustrated herein, the second user device 130 may include similarcomponents and perform similar functionality as the first user device125.

FIG. 4 is a block diagram of the database 105 included in the system 100of FIG. 1. In the example illustrated, the database 105 includes asecond electronic processor 300 (for example, a microprocessor,application-specific integrated circuit (ASIC), or another suitableelectronic device), a second communication interface 310 (including, forexample, a transceiver for communicating over one or more networks (forexample, the communication network 135)), and a second memory 305 (anon-transitory, computer-readable storage medium). The second memory 305may include, for example, the types of memory described with respect tothe first memory 205. The second electronic processor 300, secondcommunication interface 310, and second memory 305 communicatewirelessly or over one or more communication lines or buses. It shouldbe understood that the database 105 may include more, fewer, ordifferent components than those components illustrated in FIG. 4.

In the embodiment illustrated in FIG. 4, the second memory 305 includesa first type of data 315 and a second type of data 320. The first typeof data 315 may be electronically stored multimedia data related to anincident record. For example, the first type of data 315 is video datareceived from a video camera (for example, a body-worn camera)associated with a first responder who witnessed the incident. The secondtype of data 320 may be electronically stored first responder notes orreports related to the incident record. For example, the second type ofdata 320 is a text document received from the user device 125 andcreated by a first responder to record their observations with regard tothe incident. In some embodiments, both the first type of data 315 andthe second type of data 320 may be electronically stored first respondernotes or reports. It should be understood that the first type of data315 and the second type of data 320 relate to the same incident record.In some embodiments, the second memory 305 includes numerous types ofdata related to numerous incident records and that the first type ofdata 315 and the second type of data 320 are purely for illustrativepurposes. Additionally, it should be noted that each type of data may beassociated with a plurality of incident records.

In some embodiments, the types of data stored in the second memory 305of the database 105 are tagged with one or more tags. Each tag includesa unique identifier for an incident record that the type of data isassociated with. In some embodiments, the second electronic processor300 receives an indication of the incident record when the secondelectronic processor 300 receives the data. For example, the secondelectronic processor 300 may receive, from the first user device 125,the second type of data and, for example, a unique number or unique nameof an incident record that the second type of data is associated with.In other embodiments, the second electronic processor 300 automaticallydetermines an incident record that data is associated with. For example,the second electronic processor 300 may receive the first type of datafrom the first data source 115. Based on when the first data source 115captured the first type of data, a location at which the first datasource 115 captured the first type of data, or both, the secondelectronic processor 300 determines an incident record the second typeof data 320 is associated with and tags the second type of data 320 withthe unique identifier of the associated incident record.

In other embodiments, each incident record is associated with a locationin the second memory 305 and data associated with an incident record isstored in the location associated with the incident record in the secondmemory 305.

FIG. 5 is a block diagram of the electronic computing device 110included in the system 100 of FIG. 1. In the example illustrated, theelectronic computing device 110 includes a third electronic processor400 (for example, one or more of the electronic devices mentionedpreviously), a third communication interface 410 (including, forexample, a transceiver for communicating over one or more networks (forexample, the communication network 135)), and a third memory 405 (anon-transitory, computer-readable storage medium). The third memory 405may include, for example, the types of memory described with respect tothe first memory 205. The third electronic processor 400, thirdcommunication interface 410, and third memory 405 communicate via one ormore of the mechanisms mentioned previously. It should be understoodthat the electronic computing device 110 may include more, fewer, ordifferent components than those components illustrated in FIG. 5.

The third memory 405 illustrated in FIG. 5 includes an incident typemapping 415 and a machine learning model 420. The incident type mapping415 maps each type of incident to an associated priority. It should benoted that the third memory 405 may include multiple mappings that areused in combination with the incident type mapping 415 to determine thepriority of an inconsistency. For example, the third memory 405 mayinclude an originator mapping, a role type mapping, a resolution timemapping, a severity mapping, and an inconsistency impact mapping. Insome embodiments, each of the above mentioned mappings are used alone orin combination to calculate a priority of the inconsistency usingtechniques such as Bayes Theorem.

The machine learning model 420 may use, for example, logisticregression, Bayesian multivariate linear regression, or otherappropriate forms of probabilistic modeling to determine a priorityassociated with an inconsistency. In some embodiments, weights includedin the machine learning model 420 are initially set by a user but arelater updated based on user feedback to optimize prioritization. In someembodiments, the user feedback includes direct feedback from users whoresolve the inconsistency. For example, the users may provide feedbackin the form of responding to a questionnaire. In some embodiments, theuser feedback includes a time a user downstream from an originator ofinconsistent data in a chain of evidence spends resolving aninconsistency. It should be noted that the weights of the machinelearning model 420 may be adjusted manually by a user, instead of or inaddition to being updated based on user feedback.

The incident type mapping 415 and the machine learning model 420 may beused alone or in combination to determine a priority associated with aninconsistency. For example, the incident type mapping 415 and themachine learning model 420 may each determine a priority associated withan inconsistency and when the difference between the determinedpriorities is greater than a predetermined threshold, the incident typemapping 415 and the machine learning model 420 recalculate the priority.

FIG. 6 illustrates one example of a method 500 of prioritizing andresolving inconsistencies in digital evidence. The method 500 begins atblock 505 when the third electronic processor 400 receives the firsttype of data 315 and the second type of data 320. The first type of data315 may include electronically stored multimedia data related to anincident record (for example, which may have been generated by firstdata source 115 as video from a body-worn camera and tagged with aunique identifier of the incident record). The second type of data 320may include electronically stored first responder notes or reports (forexample, which may have been generated by an officer using first userdevice 125 and tagged with the unique identifier of the incident record)related to the incident record from the database 105. The thirdelectronic processor 400 may receive data by requesting data from thedatabase 105 that is associated with the incident record. Using theunique identifier associated with the incident record, the secondelectronic processor 300 retrieves from second memory 305 the types ofdata tagged with the unique identifier or stored in a memory locationassociated with the unique identifier and sends the types of data taggedwith the unique identifier to the third electronic processor 400.

At block 510, the third electronic processor 400 determines aninconsistency between the first type of data 315 and second type of data320. For example, the third electronic processor 400 may use techniquessuch as optical character recognition (OCR), image analysis (forexample, facial recognition software, object detection software, and thelike), audio analysis, and the like to detect inconsistencies betweenthe first type of data 315 and the second type of data 320. In oneexample, when the first type of data 315 is a video recording of a stakeout (for example, captured by a dashboard camera in a police vehicle)and the second type of data 320 is a police officer's account of thestake out, the third electronic processor 400 may utilize opticalcharacter recognition to determine one or more times the policeofficer's account mentions an event occurring. For example, the thirdelectronic processor 400 may determine a first time when a policeofficer recorded seeing a suspect's car and a second time when a policeofficer recorded seeing the suspect commit a crime, for example,exchanging money for illegal drugs. The third electronic processor 400may use image analysis to determine one or more frames of the videorecording captured at the first time and one or more frames of the videorecording recorded at the second time. If the suspect's car is notincluded in the one or more frames of the video recording captured atthe first time or the one or more frames of the video recording recordedat the second time does not show the suspect exchanging money forillegal drugs, the third electronic processor 400 detects aninconsistency (or determines the existence of an inconsistency). Inanother example, when the first type of data 315 is a video recording ofa robbery (for example, captured by a body-worn camera associated with apolice officer) and the second type of data 320 is the police officer'saccount of the robbery. When the police officer's account of the robberystates a shirt worn by a person suspected of committing the robbery isred while the video recording shows a shirt worn by a person suspectedof committing the robbery as blue, the third electronic processor 400detects an inconsistency.

In yet another example, when the first type of data 315 is a videorecording of an assault with a deadly weapon (for example, captured by abody-worn camera associated with a police officer) and the second typeof data 320 is the police officer's account of the assault. When thepolice officer's account of the assault states that a first suspect shotfirst while the video recording shows that a second suspect shot first,the third electronic processor 400 detects an inconsistency.

At block 515, the third electronic processor 400 determines an incidenttype from the incident record. The incident type is, for example, thetype of incident associated with the incident record that the first typeof data 315 and second type of data 320 are related to. For example, theincident type may be one of a homicide, an assault, a petty theft, anact of vandalism, and the like. Different incident types are related todifferent priorities. In general, an inconsistency related to a highpriority incident type is considered more important to address than aninconsistency related to a low priority incident type.

At block 520, the third electronic processor 400 determines, byaccessing one or both of the incident type mapping 415 and the machinelearning model 420 stored in the third memory 405 of the electroniccomputing device 110 using the determined incident type, whether aninitial priority of the determined inconsistency meets an electronicallystored threshold case impact level (for example, a predetermined valuestored in the third memory 405).

In some embodiments, the initial priority associated with aninconsistency may be a number selected from a scale of one to onehundred (1-100), where one is the lowest initial priority and onehundred is the highest initial priority. In one example, if the incidenttype of the incident record that the inconsistency has been determinedin is petty theft, an initial priority of twenty-five (25) may beassigned to the inconsistency. In another example, if the incident typeof the incident record that the inconsistency has been determined in ishomicide, an initial priority of ninety (90) may be assigned to theinconsistency. In other embodiments, the initial priority associatedwith an inconsistency may be a level encompassing a range of values. Forexample, possible initial priorities for an inconsistency may be anyvalue from 0 to 1 and a first level (the lowest initial priority) may beassigned values 0 to 0.33, a second level may be assigned values 0.34 to0.66, and a third level (the highest initial priority) may be assignedvalues 0.67 to 1. In one example, the third electronic processor 400 mayassign an inconsistency associated with an incident type of vandalism avalue of 0.35 and therefore assigns the inconsistency to the secondlevel.

In some embodiments, in addition to using one or both of the incidenttype mapping 415 and the machine learning model 420, the thirdelectronic processor 400 uses additional contextual information from thefirst or second data types to determine if a modified priority of thedetermined inconsistency meets an electronically stored threshold caseimpact level. The additional contextual information includes at leastone selected from the group comprising an originator of the first typeof data (stored in the originator mapping), an originator of the secondtype of data (stored in the originator mapping), a role (for example,police officer, forensic specialist, and the like) of the originator ofthe first type of data (stored in the role type mapping), a role of theoriginator of the second type of data (stored in the role type mapping),whether the first type of data, the second type of data, or both areassociated with more than one incident record, when an inconsistencyoccurs in a chain of evidence, a resolution time of the inconsistency(stored in the resolution time mapping), a severity associated with theincident (stored in a severity mapping), and an impact of theinconsistency (stored in the inconsistency impact mapping).

In some embodiments, the originator mapping specifies a multiplier forthe modified priority of the inconsistency based on an originator of atype of data (for example, the first type of data 315 and the secondtype of data 320). For example, if the originator of the second type ofdata 320 is a police officer who is on probation, the third electronicprocessor 400 may significantly increase the modified priority, forexample increase the modified priority by 50%-75%.

In some embodiments, the role type mapping specifies a multiplier forthe modified priority of the inconsistency based on a role of anoriginator of a type of data (for example, the first type of data 315and the second type of data 320). For example, the first type of data315 may originate from a body-worn camera of an arresting officer.Therefore, the role of the originator of the first type of data 315 isarresting officer. When the role of the originator of the first type ofdata 315 is arresting officer, the third electronic processor 400 maysignificantly increase the modified priority, for example increase themodified priority by, for example, 50%-75%. In another example, when arole of an originator of the second type of data 320 is a trainee and aninconsistency is detected in the notes of the trainee, the thirdelectronic processor 400 may only slightly increase the modifiedpriority of the determined inconsistency (for example, the thirdelectronic processor 400 may increase the modified priority by 1%-10%)or not change the modified priority at all (for example, the thirdelectronic processor 400 may increase the modified priority by 0%).

In some embodiments, the resolution time mapping specifies a multiplierfor the modified priority of the inconsistency based on the amount oftime it takes users in, for example, the chain of evidence 150 toresolve an inconsistency. For example, the third electronic processor400 significantly increases the modified priority of a determinedinconsistency by, for example, 50%-100% when the inconsistency takes auser a long time to resolve (for example, when the user has to review alarge quantity of video footage in detail in order to resolve aninconsistency). On the other hand, the third electronic processor 400may only slightly increase the modified priority of the determinedinconsistency (for example, the third electronic processor 400 mayincrease the modified priority by 1% to 10%) or not change the modifiedpriority at all (for example, the third electronic processor 400 mayincrease the modified priority by 0%) when the inconsistency takes auser a small amount of time to resolve.

In some embodiments, for each incident type, the severity mappingspecifies a multiplier for the modified priority of the inconsistencybased on a severity of the incident. For example, the third electronicprocessor 400 significantly increases the modified priority of adetermined inconsistency by, for example, 50%-100% when the incidenttype is homicide and the severity of the incident is first degreehomicide. On the other hand, the third electronic processor 400 may onlyslightly increase the modified priority of the determined inconsistency(for example, the third electronic processor 400 may increase themodified priority by 1%-10%) or not change the modified priority at all(for example, the third electronic processor 400 may increase themodified priority by 0%) when the incident type is homicide and theseverity of the incident is third degree homicide.

In some embodiments, for each incident type, the inconsistency impactmapping specifies a multiplier for the inconsistency based on the impactof the inconsistency type. Inconsistency types having a high impact on acase are defined herein as inconsistency types which affect usersdownstream in a chain of evidence (for example, inconsistencies thataffect the work of a detective or legal counsel). In one example, for ahomicide incident, the inconsistency impact mapping may state that aninconsistency regarding a suspect's clothing description has a highimpact and the third electronic processor 400 may significantly increasethe modified priority of the inconsistency by, for example, 50%-100%. Inanother example, for a homicide incident, the inconsistency impactmapping may state that an inconsistency regarding a suspect's gait (forexample, whether a suspect was running or walking up to a house) has alow impact and the third electronic processor 400 may only slightlyincrease the modified priority (by, for example, 1%-10%) or not changethe modified priority at all. In yet another example, for a petty theftincident type, an inconsistency type mapping may state that both aninconsistency regarding a suspect's clothing description and aninconsistency regarding a suspect's gait may have similarly low impactand the third electronic processor 400 only slightly increases themodified priority (by, for example, 1%-10%) or does not change themodified priority at all.

In some embodiments, when the first type of data, the second type ofdata, or both are associated with more than one incident record, thethird electronic processor 400 increases the modified priority of thedetermined inconsistency. For example, the third electronic processor400 may increase the modified priority of the inconsistency by 20% ifthe first type of data 315 is associated with two incident records andincrease the modified priority of the inconsistency by 30% if the firsttype of data 315 is associated with three incident records. The thirdelectronic processor 400 may determine the number of incident records bydetermining the number of tags associated with the first type of data315 in the database 105.

In some embodiments, the third electronic processor 400 significantlyincreases the modified priority of inconsistencies that occur early in achain of evidence (for example, the chain of evidence 150) and onlyslightly increases the modified priority of inconsistencies that occurlate in the chain of evidence 150 (by, for example, 1%-10%) or does notchange it at all. For example, for an inconsistency in evidence thatoccurred at the entry step 155 of the chain of evidence 150, the thirdelectronic processor 400 may increase the modified priority by, forexample, 75%-100%. In contrast, for an inconsistency that occurred atanalysis step 165, the third electronic processor 400 may increase themodified priority by, for example, 1%-20%.

It should be noted that, in some embodiments, instead of includingmultipliers the mappings described above may include values. In someembodiments, rather than increasing the modified priority by apercentage, the modified priority may be increased by a value, forexample, a number between 0 and 1.

At block 525, when the initial or modified priority (the priority) ofthe inconsistency meets or exceeds the stored threshold case impactlevel, the third electronic processor 400 takes a first notificationaction. At block 530, when the initial or modified priority of theinconsistency does not meet the stored threshold case impact level, thethird electronic processor 400 takes a second notification actiondifferent from the first. In one example of a notification action, thethird electronic processor 400 adds an originator of the first type ofdata and an originator of the second type of data to a groupcommunication regarding the inconsistency and sends a notification tothe group communication regarding the inconsistency. In another exampleof a notification action, the third electronic processor 400 mayidentify a first user from one of an originator of the first type ofdata, an originator of the second type of data, a user in the first typeof data, and a user in the second type of data. A user in the first typeof data or second type of data may be, for example, a user included invideo footage, a user whose name is mentioned in a report, and the like.The third electronic processor 400 identifies a second user as a user inthe first type of data or a user in the second type of data. The thirdelectronic processor 400 adds the first user and the second user to agroup communication regarding the inconsistency and sends thenotification to the group communication. Group communications may beaccessed by users via the user devices 125, 130 of the system 100. Forexample, the notification may be displayed to the originator of thefirst type of data 315 via the first user device 125 and displayed tothe originator of the second type of data 320 via the second user device130.

In some embodiments, the third electronic processor 400 takes a firstnotification action by sending a notification to a group communication(for example, the group communication including an originator of thefirst type of data 315 and an originator of the second type of data 320)and takes a second notification action by adding a notification to aqueue of inconsistency notifications associated with the incidentrecord. For example, when an initial or modified priority of adetermined inconsistency meets the stored threshold case impact level,the third electronic processor 400 sends a notification to the groupcommunication and when the initial or modified priority of thedetermined inconsistency does not meet the stored threshold case impactlevel, the third electronic processor 400 adds the determinedinconsistency to the queue of inconsistencies. The queue ofinconsistencies is accessed by users when the users wish to resolve oneor more inconsistencies. In some embodiments, the third electronicprocessor 400 adds the notifications to the end of the queue. In otherembodiments, the third electronic processor 400 adds the notificationsto the queue based on the priority associated with the notifications(for example, notifications with a higher priority are added to thefront of the queue are added to the back of the queue).

In some embodiments, the third electronic processor 400 takes a firstnotification action by blocking users following an originator of thefirst type of data and an originator of the second type of data in achain of evidence associated with the incident record. The thirdelectronic processor 400 takes a second notification action by sending anotification to a group communication (for example, the groupcommunication including an originator of the first type of data 315 andan originator of the second type of data 320). For example, when aninitial or modified priority of a determined inconsistency does not meetthe stored threshold case impact level, the third electronic processor400 sends a notification to a group communication and when the initialor modified priority of the determined inconsistency meets the storedthreshold case impact level, the third electronic processor 400 blocksusers following an originator of the first type of data and anoriginator of the second type of data in a chain of evidence associatedwith the incident record. Blocking users downstream in a chain ofevidence prevents users accessing inconsistent data in the incidentrecord that may negatively impact a case (for example, causing incorrectevidence to be presented in court). Once the inconsistency has beenresolved, the blocked user's access to the first type of data and anoriginator of the second type of data is restored.

It should be understood that, in some embodiments, there are furthertypes of notification actions which may be taken by the third electronicprocessor 400 than are described herein. For example, the thirdelectronic processor 400 may send a notification regarding aninconsistency to an originator of the first type of data and anoriginator of the second type of data individually rather than send anotification to a group communication including an originator of thefirst type of data and an originator of the second type of data. Itshould also be understood that there are multiple different combinationsof notification actions that may be performed by the third electronicprocessor 400 as a first notification action and a second notificationaction.

In some embodiments, the method 500 may be performed by the thirdelectronic processor 400 continuously, periodically, upon receiving arequest from a user, or whenever there is an update to the incidentrecord.

FIG. 7 is a flow chart of a method 600 of resolving inconsistencies indigital evidence. At block 605, the third electronic processor 400receives data (evidence) for inclusion in an incident record. Similar tothe method 500, at block 610, the third electronic processor 400determines if there is an inconsistency between a first type of data anda second type of data included in the incident record. When aninconsistency is detected, at block 615, the third electronic processor400 determines an initial and/or modified priority associated with theinconsistency, perhaps in a same or similar way as set forth withrespect to FIG. 6 and method 500. At block 620, the third electronicprocessor 400 identifies users associated with the inconsistency. Asdescribed above, the identified users may include originators of theinconsistent data, users identified in the inconsistent data, and thelike.

At block 620, the third electronic processor 400 is configured toidentify sources of supplemental data not yet included in the incidentrecord. At block 625, the third electronic processor 400 sendsnotifications to the identified users and queries or searches theidentified sources for supplementary data associated with aninconsistency. Once the supplementary data is found the supplementarydata is added to the incident record. For example, the third electronicprocessor 400 may search the database 105 for video footage of anincident that was captured from a different perspective than the videodata already included in the incident record. The supplementary data mayaid users in resolving the inconsistency.

At block 630, the third electronic processor 400 receives supplementaldata from at least one identified source, updated data from at least oneof the notified users, or both. At block 635, the third electronicprocessor 400 adds the updated data, supplemental data, or both to theincident record. In some embodiments, the third electronic processor 400flags, tags, or otherwise marks the first type of data, the second typeof data, or both as inconsistent in the stored record. For example, whenthe third electronic processor 400 receives updated data from theoriginator of the first type of data, the third electronic processor 400flags the first type of data as inconsistent data. Once the thirdelectronic processor 400 receives the updated data, supplemental data,or both, the third electronic processor 400 executes the method 600again beginning at block 610. After data is marked or flagged asinconsistent, it is not considered by the third electronic processor 400when the third electronic processor 400 executes the method 500.

In some embodiments, when multiple inconsistencies are discovered in anincident record, the third electronic processor 400 determines an orderfor resolving the inconsistencies. The determined order is related towhen in a chain of evidence (for example, the chain of evidence 150)each inconsistency occurred. For example, an inconsistency in evidencethat occurred at the entry step 155 of the chain of evidence 150 comesbefore an inconsistency that occurred at analysis step 165. The thirdelectronic processor 400 may provide the order to users associated withone or more of the discovered inconsistencies (for example, the thirdelectronic processor 400 sends the order to a group communicationincluding the users) so that inconsistencies earlier in the chain ofevidence with the potential to impact other subsequent inconsistenciesare resolved first.

In the foregoing specification, specific embodiments have beendescribed. However, one of ordinary skill in the art appreciates thatvarious modifications and changes can be made without departing from thescope of the invention as set forth in the claims below. Accordingly,the specification and figures are to be regarded in an illustrativerather than a restrictive sense, and all such modifications are intendedto be included within the scope of present teachings.

The benefits, advantages, solutions to problems, and any element(s) thatmay cause any benefit, advantage, or solution to occur or become morepronounced are not to be construed as a critical, required, or essentialfeatures or elements of any or all the claims. The invention is definedsolely by the appended claims including any amendments made during thependency of this application and all equivalents of those claims asissued.

Moreover in this document, relational terms such as first and second,top and bottom, and the like may be used solely to distinguish oneentity or action from another entity or action without necessarilyrequiring or implying any actual such relationship or order between suchentities or actions. The terms “comprises,” “comprising,” “has,”“having,” “includes,” “including,” “contains,” “containing” or any othervariation thereof, are intended to cover a non-exclusive inclusion, suchthat a process, method, article, or apparatus that comprises, has,includes, contains a list of elements does not include only thoseelements but may include other elements not expressly listed or inherentto such process, method, article, or apparatus. An element preceded by“comprises . . . a,” “has . . . a,” “includes . . . a,” or “contains . .. a” does not, without more constraints, preclude the existence ofadditional identical elements in the process, method, article, orapparatus that comprises, has, includes, contains the element. The terms“a” and “an” are defined as one or more unless explicitly statedotherwise herein. The terms “substantially,” “essentially,”“approximately,” “about” or any other version thereof, are defined asbeing close to as understood by one of ordinary skill in the art, and inone non-limiting embodiment the term is defined to be within 10%, inanother embodiment within 5%, in another embodiment within 1% and inanother embodiment within 0.5%. The term “coupled” as used herein isdefined as connected, although not necessarily directly and notnecessarily mechanically. A device or structure that is “configured” ina certain way is configured in at least that way, but may also beconfigured in ways that are not listed.

It will be appreciated that some embodiments may be comprised of one ormore generic or specialized processors (or “processing devices”) such asmicroprocessors, digital signal processors, customized processors andfield programmable gate arrays (FPGAs) and unique stored programinstructions (including both software and firmware) that control the oneor more processors to implement, in conjunction with certainnon-processor circuits, some, most, or all of the functions of themethod and/or apparatus described herein. Alternatively, some or allfunctions could be implemented by a state machine that has no storedprogram instructions, or in one or more application specific integratedcircuits (ASICs), in which each function or some combinations of certainof the functions are implemented as custom logic. Of course, acombination of the two approaches could be used.

Moreover, an embodiment can be implemented as a computer-readablestorage medium having computer readable code stored thereon forprogramming a computer (for example, comprising a processor) to performa method as described and claimed herein. Examples of suchcomputer-readable storage mediums include, but are not limited to, ahard disk, a CD-ROM, an optical storage device, a magnetic storagedevice, a ROM (Read Only Memory), a PROM (Programmable Read OnlyMemory), an EPROM (Erasable Programmable Read Only Memory), an EEPROM(Electrically Erasable Programmable Read Only Memory) and a Flashmemory. Further, it is expected that one of ordinary skill,notwithstanding possibly significant effort and many design choicesmotivated by, for example, available time, current technology, andeconomic considerations, when guided by the concepts and principlesdisclosed herein will be readily capable of generating such softwareinstructions and programs and ICs with minimal experimentation.

The Abstract of the Disclosure is provided to allow the reader toquickly ascertain the nature of the technical disclosure. It issubmitted with the understanding that it will not be used to interpretor limit the scope or meaning of the claims. In addition, in theforegoing Detailed Description, it can be seen that various features aregrouped together in various embodiments for the purpose of streamliningthe disclosure. This method of disclosure is not to be interpreted asreflecting an intention that the claimed embodiments require morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive subject matter lies in less than allfeatures of a single disclosed embodiment. Thus the following claims arehereby incorporated into the Detailed Description, with each claimstanding on its own as a separately claimed subject matter.

We claim:
 1. A system for prioritizing and resolving inconsistencies indigital evidence, the system comprising a database containing a firsttype of data including electronically stored multimedia data related toan incident record and a second type of data including electronicallystored first responder notes or reports related to the incident record;and an electronic computing device including an electronic processor,the electronic processor configured to: receive the first type of dataand the second type of data from the database; determine aninconsistency between the first type of data and the second type ofdata; determine an incident type from the incident record; determine, byaccessing one or both of an incident type mapping and a machine learningmodel using the determined incident type, whether a priority of thedetermined inconsistency meets an electronically stored threshold caseimpact level; when the priority of the inconsistency meets the storedthreshold case impact level, take a first notification action; and whenthe priority of the inconsistency does not meet the stored thresholdcase impact level, take a second notification action different from thefirst.
 2. The system according to claim 1, wherein the electronicprocessor is further configured to: add an originator of the first typeof data and an originator of the second type of data to a groupcommunication regarding the inconsistency.
 3. The system according toclaim 1, wherein the electronic processor is further configured to:identify a first user from one of an originator of the first type ofdata, an originator of the second type of data, a user in the first typeof data, and a user in the second type of data.
 4. The system accordingto claim 3, wherein the electronic processor is further configured to:identify a second user as a user in the first type of data or a user inthe second type of data; and add the first user and the second user to agroup communication regarding the inconsistency.
 5. The system accordingto claim 1, wherein the electronic processor is further configured to:use additional contextual information from the first or second datatypes to determine when the priority of the inconsistency meets theelectronically stored threshold case impact level, wherein theadditional contextual information includes at least one selected fromthe group comprising an originator of the first type of data, anoriginator of the second type of data, a role of the originator of thefirst type of data, a role of the originator of the second type of data,whether the first type of data, the second type of data, or both areassociated with more than one incident record, when an inconsistencyoccurs in a chain of evidence, a resolution time of the inconsistency, aseverity associated with the incident, and an impact of theinconsistency.
 6. The system according to claim 2, wherein theelectronic processor is further configured to: take a first notificationaction by sending a notification to the group communication; and take asecond notification action by adding a notification to a queue ofinconsistency notifications associated with the incident record.
 7. Thesystem according to claim 2, wherein the electronic processor is furtherconfigured to: take a first notification action by blocking usersfollowing the originator of the first type of data and the originator ofthe second type of data in a chain of evidence associated with theincident record; and take a second notification action by sending anotification to the group communication.
 8. The system according toclaim 1, wherein the electronic processor is configured to: search thedatabase for supplementary data associated with the inconsistency thatis not yet included in the incident record; and add the supplementarydata to the incident record.
 9. The system according to claim 1, whereinthe electronic processor is configured to: receive updated data from anoriginator of the first type of data, an originator of the second typeof data, or both; add the updated data to the incident record; and flagthe first type of data, the second type of data, or both asinconsistent.
 10. The system according to claim 1, wherein the machinelearning model is updated based on user feedback.
 11. The systemaccording to claim 10, wherein the electronic processor is configuredto: record a time a user following an originator of the first type ofdata and an originator of the second type of data in a chain of evidenceof the incident record spends resolving the inconsistency; and includethe time in the user feedback used to update the machine learning model.12. A method of prioritizing and resolving inconsistencies in digitalevidence, the method comprising: receiving, with an electronicprocessor, a first type of data including electronically storedmultimedia data related to an incident record and a second type of dataincluding electronically stored first responder notes or reports relatedto the incident record from a database; determining an inconsistencybetween the first type of data and the second type of data; determiningan incident type from the incident record; determining, by accessing oneor both of an incident type mapping and a machine learning model usingthe determined incident type, whether a priority of the determinedinconsistency meets an electronically stored threshold case impactlevel; when the priority of the inconsistency meets the stored thresholdcase impact level, taking a first notification action; and when thepriority of the inconsistency does not meet the stored threshold caseimpact level, taking a second notification action different from thefirst.
 13. The method according to claim 12, the method furthercomprising: adding an originator of the first type of data and anoriginator of the second type of data to a group communication regardingthe inconsistency.
 14. The method according to claim 12, the methodfurther comprising: identifying a first user from one of an originatorof the first type of data, an originator of the second type of data, ana user in the first type of data, and a user in the second type of data.15. The method according to claim 14, the method further comprising:identifying a second user as a user in the first type of data or a userin the second type of data; and adding the first user and the seconduser to a group communication regarding the inconsistency.
 16. Themethod according to claim 12, the method further comprising: usingadditional contextual information from the first or second data types todetermine when the priority of the inconsistency meets an electronicallystored threshold case impact level, wherein the additional contextualinformation includes at least one selected from the group comprising anoriginator of the first type of data, an originator of the second typeof data, a role of the originator of the first type of data, a role ofthe originator of the second type of data, whether the first type ofdata, the second type of data, or both are associated with more than oneincident record, when an inconsistency occurs in a chain of evidence, aresolution time of the inconsistency, a severity associated with theincident, and an impact of the inconsistency.
 17. The method accordingto claim 13, wherein taking a first notification action includingsending a notification to the group communication; and taking a secondnotification action including adding a notification to a queue ofinconsistency notifications associated with the incident record.
 18. Themethod according to claim 13, wherein taking a first notification actionincludes blocking users following the originator of the first type ofdata and the originator of the second type of data in a chain ofevidence associated with the incident record; and taking a secondnotification action includes sending a notification to the groupcommunication.
 19. The method according to claim 12, the method furthercomprising: receiving updated data from an originator of the first typeof data, an originator of the second type of data, or both; adding theupdated data to the incident record; and flagging the first type ofdata, the second type of data, or both as inconsistent.
 20. The systemaccording to claim 12, wherein the electronic processor is configuredto: recording a time a user following an originator of the first type ofdata and an originator of the second type of data in a chain of evidenceof the incident record spends resolving the inconsistency; and includingthe time in user feedback used to update the machine learning model.